The vulnerability is a CSRF flaw that permits an attacker to inject scripts that become stored in the WordPress site. When a legitimate admin or authenticated user unknowingly processes a forged request, the attacker’s payload is saved and subsequently executed for all visitors. This stored XSS can lead to defacement, credential theft, cookie theft, or session hijacking. The weakness is associated with CWE-352.

Alexander Rauscha's mLanguage plugin for WordPress, versions up to and including 1.6.1, is affected. Any WordPress instance using an installed plugin version <= 1.6.1 is vulnerable. No additional version restrictions were provided.

The CVSS base score of 7.1 indicates a high impact and moderate exploitation complexity. The EPSS score is below 1%, suggesting that exploitation has been observed infrequently so far, and the vulnerability is not present in CISA’s KEV catalog. Attackers could perform the exploit by provoking an authenticated user to visit a crafted link or submit a forged form that triggers the malicious XSS via the plugin’s endpoints. Successful exploitation depends on the victim’s authentication status and access to the problematic plugin functionalities.